Senior Researcher: UN's use of refugee biometrics should be reviewed

Ten years ago, the United Nations High Commissioner for Refugees, UNHCR, only used biometrics in very few cases. Now, the UNHCR collects biometric data from all those they provide assistance to.

In 2022, the UNHCR reported using biometrics in 79 operations globally. In other words, UNHCR has huge amounts of sensitive biometric data from refugees registered by the organisation.

The extensive collection and storage of sensitive personal data was on the agenda when UNHCR consulted ten experts last week. Katja Lindskov Jacobsen, who was among the experts, answers some of the key questions from the consultation.

What are the challenges of using refugees' biometric data?

"The challenges with UNHCR's use of biometrics are many. You can roughly divide them into three categories: before, during and after. ‘Before’, there are challenges as to whether it is truly informed consent when a refugee is asked to register their fingerprints when approaching the UNHCR to ask for vital emergency aid. The person may believe that not agreeing to have their biometric data registered may affect their access to emergency assistance."

"During the period when UNHCR is storing millions of refugees' sensitive biometric data in centralised databases, there are challenges in securing that data. In addition, there are crucial questions about how, when and with whom that data might be shared – and whether refugees are even made aware that this is happening. 'After', one of the key questions is how long that data is retained. Currently, UNHCR keeps it indefinitely. Many have questioned the necessity of this."

What are the risks of registering refugees' biometric data?

"Unfortunately, there are quite a few risks. One example, which is not directly related to UNHCR, but which clearly illustrates one type of risk, we saw in Afghanistan in August 2021, when Western coalition forces left the country in a hurry. Here, the biometric data that the Western forces had collected from their Afghan partners ended up in the hands of the Taliban – for whom that data did not represent a fingerprint from a well-meaning partner, but rather from people who had collaborated with the enemy."

"The fact that biometric data can end up in the hands of actors who use it for purposes other than those for which it was originally collected is a very serious risk."

How does UNHCR address the challenges you mention?

"A lot has happened since UNHCR first started using biometrics. It's important in itself that the UN now has a much greater focus on the issue of protecting the sensitive data they collect. The consultation I just contributed to was just one of many initiatives the UNHCR has undertaken, including a number of practical and technical measures. UNHCR has also revised their refugee enrolment policies to focus much more on the protection of biometric data and principles for how that data is handled."

How can the use of refugee biometric data be made even more secure?

"There is a long list of things to consider in all three areas – before, during and after. One of the things to consider is how long it is necessary for UNHCR to keep the data it collects. But also whether it is necessary to collect biometrics from all the millions of refugees that UNHCR protects and delivers emergency assistance to."

"The more biometric data the UNHCR collects and stores, the greater the risk that biometric data collected in the course of well-intentioned relief efforts could be used in ways that have unwanted, negative consequences for some of the world's most vulnerable individuals. This is the case, for example, if the UNHCR shares biometric data with the country from which refugees have fled, maybe because they were at risk of abuse by a government that should not have access to such sensitive data on vulnerable individuals."